Recast Supplier Terms and Controls for AI, OT, and Datacenter Risk

What happened

More than 30 Minnesota community water systems were disrupted in a coordinated cyber incident that targeted operational technology. State and federal advisories had warned of Iran‑linked actors exploiting PLCs, and security firms see patterns consistent with known groups, making this operationally real for small municipal suppliers. Watch whether affected utilities publish supplier forensic findings and whether follow‑on advisories expand affected vendor lists

Why the category manager should care

Treat municipal OT suppliers as high‑risk execution dependencies and validate their incident readiness during renewals because their failure can create immediate availability and public‑health obligations

Key facts

• More than 30 community water systems disrupted
• Incidents occurred on July 26–27 and involved OT/PLCs
• CISA advisory added Schneider and Siemens equipment as potential targets

What happened

The US Commerce Department signaled support for GlobalFoundries with a $300M letter of intent tied to silicon photonics development and took a minority stake. The move is meant to accelerate optical interconnect tech for datacenters and may speed supplier roadmaps for co‑packaged optics and advanced packaging. Watch vendor roadmaps and supplier lead times for optical modules as domestic capacity objectives change procurement timing

Why the category manager should care

View this as a signal that silicon photonics will move faster into production-grade networking; align sourcing timelines for optical upgrades with supplier commitments because supply windows may tighten

Key facts

• $300M letter of intent from US government
• Government takes a one percent stake
• Program supports silicon photonics and advanced packaging for datacenter connectivity

What happened

A researcher disclosed a class of document‑borne worm that can hide instructions in Word files and cause Copilot for Word to rewrite documents and copy the worm into newly created files, enabling self‑propagation. Microsoft and the researcher worked together since March, but variants remain viable; the attack model works without tenant compromise and can spread through normal document workflows. Buyers should monitor vendor mitigations closely and enforce workflow‑level controls until fixes prove effective

Why the category manager should care

Assume externally sourced documents are untrusted for AI contexts and require vendor controls and proof‑of‑fix before relaxing restrictions because the worm class can propagate without tenant access

Key facts

• Researcher reported collaborating with Microsoft since March
• Public disclosure occurred after a 144‑day coordination period
• Exploit can propagate without tenant compromise via normal document workflows

What happened

Perplexity expanded its Model Council multi‑model feature into its Computer product and uses usage‑based credit billing where 100 credits equal $1. The multi‑model approach and per‑task credit consumption can materially change cost profiles for enterprise AI workloads if buyers adopt synthesis or heavy asset generation workflows. Watch how vendors expose usage meters and whether enterprise pricing includes meaningful caps or predictable tiers

Why the category manager should care

Treat usage‑billed AI offerings as a different procurement category; require granular usage reporting, caps, and predictable pricing because consumption can spike costs quickly

Key facts

• Model Council expanded to Computer platform with up to eight perspectives
• 100 Computer credits are equal to $1
• Tasks range from light (100–350 credits) to heavy (up to 2,275 credits) consumption models

What happened

The UK competition regulator opened an investigation into whether Microsoft misled customers by automatically moving them onto pricier Microsoft 365 plans that included Copilot features. The probe questions whether customers were given clear notice and opt‑out paths, making subscription communication and renewal mechanics a buyer risk vector. Buyers should verify renewal notices and contractual opt‑outs to avoid unintended tier upgrades

Why the category manager should care

Require explicit renewal communications, opt‑out mechanics, and transparency in any plan changes because automatic upgrades can create unexpected cost and contract disputes

Key facts

• Investigation centers on automatic movement to Copilot‑equipped plans at renewal
• Remaining on the Copilot plan cost customers an extra £25 per year compared with Classic plan
• Regulator will examine whether customers were clearly informed about options